877475 - Assertion failure: ion::IsEnabled(cx), at ion/Ion.cpp:1779 with OOM

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 8d85de779506 (no options required):


try {
  oomAfterAllocations(5);
  function mutate(val, index, arr) {
    return true;
  }
  var a = [1, 2];
  var m = a.filter(mutate);
} catch(exc0) {}

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision b7175c5829b5).

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, failed due to error (try manually).

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/ce43d28276e4
user:        Brian Hackett
date:        Fri Jun 14 05:58:28 2013 -0600
summary:     Bug 678037 - Enable lazy JS parsing and fix various bugs, r=waldo,evilpie,nobody.

Brian, is it possible that bug 678037 fixed this?

Comment 5

[Brian Hackett [Laid off!]]

No, oomAfterAllocations will be super fragile and 678037 affects where allocations happen.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Setting needinfo? from our OOM-guru Iain to check this out.

Comment 7

[Jan de Mooij [:jandem]]

If you no longer see this I think we can close this bug.

It used to be that we disabled TI (and therefore Ion) on OOM. We no longer do that.

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Yes, not seeing this anymore.

=> WFM